Solved

I would like to ask that how we suggest fortigate to customer ,  For example we have 500 user so how we will check which device is best and what will be through output will be better for it

Hello, I am adding a new IP range to our WAN1 port and came across a weird issue/confusion on how the fgt is defining these fields in the GUI. I am probably overthinking it, but are we supposed to put in the full Assigned LAN Netblock address with /28 the IP assigns me in the fgt Network/Interfaces/edit WAN1 "IP/Netmask" field, or just the first LAN Usable IP (205.105.155.146/255.255.255.240 - or 255.255.255.255)? Same goes for my static routes. The ISP gave me a Default Gateway for LAN Netblock to use - that should be my static route, correct? 0.0.0.0/0.0.0.0 as the IP/Mask and 205.105.155.145 for the Gateway under Router/Static/Static Routes? Example of what we were provided, including explanation from ISP:Assigned LAN Netblock  - 205.105.155.144/28Subnet Mask: 255.255.255.240LAN Usable IPs: 205.105.155.146 through 205.105.155.158*You mas assign these IPs to your LAN (LAN Default Gateway, PC, Workstation, Firewall, etc)Default Gateway for LAN Netblock: 205.105.155.145

Hi! Guys, I got some problems with new firmware. I use fg300d with FO 5,4. There is configured dial-in ipsec. Everything worked fine until now. All tunnels are hung up. All services are blocked except port forwarding so i could connect to putty's serial console. There are a lot of messages such as "unregister_netdevice: waiting for IPSec NAT_6 to become free. Usage count = 1".  I event cant execute reboot. System just wrote that it is going to reboot bye-bye - and just continue to posts that error messages about netdevice. FG is situated in the data center, so i unable just to switch off and on it...  I'm just in a jam... any help is highly appreciated... Thanks! 

Hello there, is there a option in the EMS to configure a pattern Update interval or something like this? Thanks. Regards, Rolf

Hello, Hope someone can help here. The fortigate seems to skip web filtering following application control. Is this normal? Thanks in advance.

I have a FGT90D that is presenting a strange issue. When I pull up Fortiview and look at Applications, it shows the wrong service/application icons for applications. For example, it may show the Facebook icon for Outlook or the Spotify logo for Dropbox. While its not majorly critical, its an odd issue and it looks off.  Anyone else experience this issue? Thx, Kevin 

I have in the Anti-Spam profile a WhiteList entry likeType: Email WildcardPattern: *@domain.comAction: Mark as ClearStatus: enable But still EMails from this Domain are blocked with the Message: smtp helo/ehlo domain name DNS check failed. How can i solve this without setting the Source-IP on WhiteList?

I have tried "/pm/config/adom/FortiManager/obj/webfilter/urlfilter", but nothing was returned.

Hello,Does FortiOS support OpenVPN server?ThanksAndreas

I had a few different servers go down recently - they just go comatose and need to reboot. I've also had a few of those servers run out of HD space from the windows temp file being full.  When I checked I had about 1 million GIUD type directories with files like vir_extreme_flat_sig.tmp   And a whole bunch of log files from some installer. These look like forti files to me.   Anyone else having this issue?  Any ideas on how to fix?

Dear colleagues,  do you know if and when a virtual appliance version of the FortiWLC will be released?

Hello, I have just implemented Deep Packet SSL Inspection on our Fortigate firewall.I am finding instances of SSL certificate pinning (HPKP) where I need to make exceptions to the DPI list e.g. *.google.com etc.This fixes the problem.What I am finding strange is how some of the sites I need to make exceptions for do not 'seem' to be using HPKP pinning (or HSTS.For example, I look within Chrome browser 'chrome://net-internals/#capture' I do not see any entries for those particular sites using pinning or HSTS (HTTP strict transport security). Also when I do lookups to public SSL verification sites they say there are no HPKP or HSTS headers being used on that site.Why would this be ?Could it be to do with the fact that some sites aggregate content from many other sites and perhaps one of those sites is using HPKP or HSTS headers ?The other strange issue is that sometime these problem sites work for users and sometimes they don't. Could this related to the above, in that these sites may be

Hi!I am just using my first FG 200Es (OS: 5.4.4)As they do not have a SSD, I need to log to memory. Everything is working fine, but the log is VERY small. It does just keep the last 140-170 lines. Is this the "normal behaviour"? Is it safe to increase the max-size of the memory-log: config log memory global-setting    set max-size 2236949end Standard-Size is 65536 One second thing: Is there any possibility to let the two nodes of a HA-cluster boot "one after the other", if I change that setting? Thank youRegards,KPS 

Hi, I am using Fortigate 200D, i want to restrict users from downloading files larger than 20MB based on policycan someone help me step by step Thanks and RegardsMirza

Hi there,  On the Lifecycle announcements from the support website, there's no 60D mention. I know that 60D is a model from 2013 and now this hardware has 4 years old. Is there any other way to confirm the lifecycle from a 60 D-series model  ? Thank you !  Luiz CamiloNCT Informática

Hello,I am not very practice with Fortigate and I am analyzing the company firewall policies, so I would like to know the meaning of the policies in the attached file.The direction of the policies is IN >> OUTThank you--Nicola

Hi, We want to replace our Fortinet AP FAP221C with something better. We have problems with Apple devices like iPhone and laptops they frequently disconnects from access points. Can someone recommend more reliable Fortinet model? Thanks,Aigars 

Hi Everyone - first post here. I'm new to fortinet but hopefully I have a simple question for the experts. We are about to activate a new WAN service from a new ISP. Currently, our 100D is configured only for WAN1, but I would like to keep that config as there are a lot of rules and site-site VPN config that I wouldn't know how to duplicate if we brought in the new WAN link and connected it to WAN2. So my question is: can I simply edit the .cfg backup file from the existing config and search for all references to my existing IP and replace it with the new IPs? Then, once it's up and running on the new IP I can go back and take my time and manually build WAN2 as a redundant link. The current WAN1 link is just a slow 20Mb/20Mb and the new is 100Mb/100Mb. Since the switchover is so critical this method seems like it would be really fast and basically come online instantly, the site-site tunnel would reestablish itself after i changed the IPs on the destination fortigate also. Anyone w

HiI want to compare fortiweb 1000D and 3000E cpu model?

Hello,I have a  90D at office . Connected by Normal Ethernet switches to Workstations and Wifi access points. I blocked unwanted applications on PCs but the same apps opens in Wifi.Any help would be really appreciated. Thank you.   

Hello Does anyone know where I can find a list of code status and their meaning for command "diagnose debug crashlog read" When I execute that command I get:# di debug crashlog read | grep 2016-12-08 12654: 2016-12-08 08:42:39 the killed daemon is /bin/pyfcgid: status=0x100 What does "0x100" mean? what are other possible code status? Thank you

Can you authenticate via an ldap user to the SSL web portal? Using 5.2.2 Forticlient. I just today set up the web portal, so something could definitely be misconfigured there. However, I created an SSL VPN Group, added the Domain Users group to it as a test from AD. Also created a local user called "test" and added it to that group.  I can log in as 'test' but not as any user of AD. 

ipsec site to site vpn configured. on WAN2 i have staic Ip, and on WAN1 i have normal internet connectivity. i want to use WAN1 for internet traffic and WAN 2 (configured with static ip) for site to site and access vpn. how can i achieve it ? please help me out. 

We user FSSO to authenticate users for web traffic. We don't use explicit proxy because of office365 performance.When there are multiple users on one server, user traffic from a user will be identified as traffic from another user on the same server. This is not what we want. Did anyone run into the same problem and is there a solution? We use FSSO with a Collector Agent on one of our DC's and agents on the other DC servers. 

We have 1 FortiGate that handles the routing of our internal networks as well as the outside world. I'm looking for a way to allow server A on network A to know who server B on network B is when they communicate. With NAT on, when this communication happens, server A sees the communication as coming from the FortiGate instead of from server B. I need to be a to set something like an X-Forwarded-For header on the traffic, or be able to to NAT just the external traffic and set the inside networks to transparency. My understanding is that since we just have the single device which handles inside and outside, I have to have NAT but the FortiGate seems to only allow yes or no when it comes to NAT. Can anyone shed some light on this issue?